Proposal & Statement of Work
This Annex A sets out the scope, approach, deliverables and fees for one engagement; signing it authorises testing of the listed assets only, read together with the Authorisation to Test (Document 04).
1. Engagement summary
1.1. Engagement ID: VF-2026-001. Prepared by Provider legal name, trading as Verfend (Independent Security Operations), for Client legal name.
1.2. This Proposal describes a security audit / finding validation / remediation engagement for the assets in section 3. It forms Annex A to the Service Agreement (Document 03) and follows Verfend's promise: find the flaw, prove the impact, confirm the fix (SCAN / VERIFY / RETEST).
1.3. The "from" prices shown on the website are starting points only. The fees in section 11 prevail for this scope.
2. Objectives
2.1. e.g. Assess the security posture of the in-scope web application and its supporting hosts, confirm the real-world impact of any issues, and provide prioritised remediation guidance.
2.2. Each confirmed issue ("finding") is recorded with a finding ID (e.g. SEC-001) and rated Critical / High / Medium / Low using CVSS v3.1.
3. In-scope assets
Only the assets listed here are tested.
| Asset | Type | Environment | Access level |
|---|---|---|---|
| app.example.com | Web application | Production / Staging | External / Grey-box / White-box |
| api.example.com | REST API | Staging | Grey-box |
| ... | ... | ... | ... |
4. Exclusions
4.1. Out of scope: third-party services, payment gateways, and any domains or hosts not listed above.
4.2. Excluded by default unless separately agreed in writing: denial-of-service and stress/load testing, social engineering and phishing, physical intrusion, and destructive actions.
4.3. Testing of hosted infrastructure is subject to the hosting/cloud provider's own testing policy (see section 12 and the Service Agreement, Document 03, §13).
5. Services selected
☐ Validate — finding validation of one reported concern ☐ Assess — scoped security audit ☐ Resolve — vulnerability remediation support with retest ☐ Monitoring — ongoing scheduled checks with reviewed notifications
6. Approach & methodology
6.1. Work follows recognised practice: OWASP WSTG and ASVS, PTES, and CVSS v3.1 for severity.
6.2. Automated scanning identifies candidate issues; every reported finding is then confirmed by manual verification to remove false positives and demonstrate real impact.
6.3. Verfend favours non-disruptive techniques, works only against the agreed assets within the agreed window, and honours the stop-word protocol (STOP, halt within 15 minutes) set out in the Authorisation to Test (Document 04) and the Service Agreement (Document 03).
7. Testing window & time zone
7.1. Planned window: dd mmm yyyy to dd mmm yyyy, 09:00–18:00 (America/Recife, UTC−3).
7.2. Testing starts only after the Service Agreement (Document 03) and the Authorisation to Test (Document 04) are both signed.
8. Access required
8.1. External (black-box): none beyond the public asset list.
8.2. Grey-box: number dedicated least-privilege test accounts per role, provided by the Client.
8.3. White-box: read access to source code and a representative staging environment.
8.4. The Client provisions access, allow-lists Verfend's test source IPs where needed, and names an authorised technical contact.
9. Deliverables
9.1. A written report in PDF, delivered through the agreed secure channel, containing:
- an executive summary for non-technical readers;
- technical findings with evidence (requests, responses, screenshots) and reproduction steps;
- prioritised remediation guidance for each finding;
- a retest statement where Resolve is in scope.
9.2. A debrief call of up to 60 minutes to walk through the findings.
10. Timeline
| Stage | Indicative timing |
|---|---|
| Scope & proposal | on acceptance |
| Agreement & sign-off | 1–2 days |
| Access provisioned | 1–3 days |
| Testing window | per section 7 |
| Report & debrief | within 5 business days of the testing end |
| Remediation & retest | by arrangement |
11. Fees
11.1. Fixed price for the scope above: currency: BRL / USD / EUR amount, exclusive of tax unless stated.
11.2. Payment schedule (per the Payment Terms, Document 13): 50% on signature of this Annex A, 50% on delivery of the report.
11.3. Work beyond this scope needs a written change order and may adjust the fee and timeline. Remediation and monitoring are priced separately.
12. Assumptions & client responsibilities
12.1. The Client owns, or is duly authorised to permit testing of, every listed asset, and has confirmed that its hosting/cloud provider's terms permit the agreed testing and obtained any separate consent the provider requires.
12.2. The Client provides timely access, test data and a responsive point of contact during the window.
12.3. Environments are reasonably stable during testing; the Client is responsible for its own backups.
12.4. Delays in access or sign-off may move the window by agreement.
13. Validity
This Proposal is valid for 14 days from its date; after that, scope and fees may be re-quoted.
14. Acceptance
By signing below, the Client accepts this Proposal & Statement of Work and, together with the Authorisation to Test (Document 04), authorises Verfend to test the listed assets only. This Annex A forms part of the Service Agreement (Document 03).
Provider: ______________ Date: ________
Client: ______________ Date: ________
Verfend · Independent Security Operations · email · website · Document 02 v1.0 · date